Home / server / Questions / 15106
Accepted
gharper
Asked: 2009-05-30 12:30:47 +0800 CST

Is there a way to filter syslog entries?

  • 772

I have a cluster of Linux servers that are fronted by a load-balancer, which probes each server every 5 seconds to determine if it's operational. These probes generate a lot of useless noise in the logs, and I'd like to simply not have them logged...

Is there a way to prevent rsyslog from logging specific events?

linux syslog

3 Answers

  1. Best Answer

    Check out the rsyslog filter documentation. Here is an example from the docs on how to filter a message. The filter would need to be place in the configuration file before the section that defines the log where the annoying message is being delivered too.

    :msg, contains, "informational"  ~

    All messages containing the string "informational" are discarded.

    • 14

  2. It might be easier to configure those specific entries to go to some other file that is either rotated more often, or maybe even (if you really don't care about the output), /dev/null

    If you can't use normal syslog facility filtering, try checking the expression-based filters: http://www.rsyslog.com/doc-rsyslog_conf_filter.html

    • 3

  3. Also consider taking a look at swatch, which let's you customize, colorize and filter log viewing.

    • 0